openapi: 3.1.0
info:
  title: ACME (RFC 8555) Protocol Account API
  description: The Automatic Certificate Management Environment (ACME) protocol, defined in IETF RFC 8555, automates the interactions between Certificate Authorities and clients for issuing, renewing, and revoking X.509 certificates. ACME requests are JSON Web Signature (JWS) payloads carried over HTTPS. Server URLs are advertised by each ACME directory; this spec uses generic /acme/* paths.
  version: 1.0.0
  contact:
    name: IETF Datatracker
    url: https://datatracker.ietf.org/doc/html/rfc8555
  license:
    name: IETF Trust
    url: https://trustee.ietf.org/license-info
servers:
- url: https://acme-v02.api.letsencrypt.org
  description: Let's Encrypt production ACME directory (reference implementation)
- url: https://acme-staging-v02.api.letsencrypt.org
  description: Let's Encrypt staging ACME directory
tags:
- name: Account
  description: Account creation and key management.
paths:
  /acme/new-account:
    post:
      operationId: newAccount
      summary: Create or look up an account
      description: Create a new ACME account or retrieve an existing one. Body is a JWS object.
      tags:
      - Account
      requestBody:
        required: true
        content:
          application/jose+json:
            schema:
              $ref: '#/components/schemas/JwsRequest'
      responses:
        '201':
          description: Account created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
        '200':
          description: Existing account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
  /acme/key-change:
    post:
      operationId: keyChange
      summary: Roll over the account key
      description: Perform an account key rollover.
      tags:
      - Account
      requestBody:
        required: true
        content:
          application/jose+json:
            schema:
              $ref: '#/components/schemas/JwsRequest'
      responses:
        '200':
          description: Key rolled over
components:
  schemas:
    GenericResponse:
      type: object
      additionalProperties: true
    JwsRequest:
      type: object
      description: A JSON Web Signature (JWS) flattened serialization object.
      properties:
        protected:
          type: string
          description: Base64url-encoded JWS Protected Header.
        payload:
          type: string
          description: Base64url-encoded payload.
        signature:
          type: string
          description: Base64url-encoded JWS signature.
      required:
      - protected
      - payload
      - signature
      additionalProperties: true
x-generated-from: https://datatracker.ietf.org/doc/html/rfc8555
x-generated-by: claude-crawl-2026-05-08